Can someone tell me from the technical point of view, why is :

1. Existing username + existing 8 character password = safe (I presume this is safe otherwise you won't be using the same password for n years)
2. Existing username + (existing 8 character password + random character string) = unsafe

U need to learn how to read. They said "continue to be protected" but didn't say it was not breached.